India's real estate sector operates at the high-stakes intersection of monetary transactions, multi-tiered vendor ecosystems, and extensive consumer data acquisition. While developers and real estate intermediaries have historically prioritized title due diligence, RERA project disclosures, and tax structuring, the enactment of the Digital Personal Data Protection (DPDP) Act, 2023 adds a complex layer of statutory obligations. Real estate entities must establish a harmonized compliance model that balances the strict erasure principles of the DPDP Act against non-negotiable statutory retention mandates under GST, Income Tax, PMLA, RERA, and CERT-In rules.
SECTION 1 — Core Obligations Under the DPDP Act, 2023
Real estate entities regularly process highly sensitive consumer profiles—including financial statements, Income Tax PANs, government identity proofs, and property preferences. Upon full enforcement, the DPDP Act mandates fundamental operational shifts:
- Itemized Notice & Consent Architecture (Sections 5 & 6): Generic, pre-checked, or omnibus consent clauses embedded in booking applications are legally invalid. Entities must present an itemized notice detailing the exact data collected and its specific purpose. Consent must be free, specific, informed, unconditional, and unambiguous. Data Principals must also be explicitly informed of their statutory right to withdraw consent and access grievance redressal mechanisms.
- Vendor & Processor Safeguards (Section 8(5)): Entities must implement reasonable security safeguards to prevent data breaches and execute formal Data Processing Agreements (DPAs) with channel partners, CRM software vendors, and facility management providers.
- Mandatory Breach Notification (Section 8(6)): Upon discovering a personal data breach, Data Fiduciaries are statutorily bound to notify both the Data Protection Board of India (DPBI) and each affected Data Principal in the prescribed form and manner.
- Significant Data Fiduciaries (Section 10): Real estate developers with large customer databases or high transaction volumes may be designated as Significant Data Fiduciaries (SDFs) by the Central Government. SDF status mandates appointing a resident Data Protection Officer (DPO), contracting an independent Data Auditor, and conducting periodic Data Protection Impact Assessments (DPIAs).
SECTION 2 — Reconciliation of DPDP Erasure Mandates vs. Statutory Overrides
A central compliance challenge under Section 8(7) of the DPDP Act is the requirement to erase personal data once the specified purpose is satisfied or upon withdrawal of consent. However, Section 8(7) contains an explicit statutory proviso: erasure is not required where data retention is necessary for compliance with any active law in force. Sectoral retention timelines operate as statutory carve-outs that override general DPDP erasure requests:
| Regulatory Framework | Mandatory Retention Term | Statutory Scope & Compliance Objective |
|---|---|---|
| GST Act, 2017 | 72 Months (6 Years) | Retain books of accounts, ledgers, and tax invoices from the due date of filing the relevant Annual Return. |
| Income Tax Framework | 7 Tax Years | Retain financial records, buyer ledgers, and cash flow statements from the end of the relevant tax year (extendable up to 10 years in reassessment proceedings). |
| PMLA, 2002 | 5 Years | Real estate agents operating above specified turnover thresholds (acting as Reporting Entities) must retain buyer KYC and transaction records post-transaction. |
| RERA, 2016 | 5 Years | Retain complete project records, promoter disclosures, architectural plans, and buyer agreements post-completion or revocation. |
| Companies Act, 2013 | 8 Financial Years | Incorporated real estate entities must maintain books of account and supporting vouchers for preceding financial years. |
SECTION 3 — Statutory DPDP Penalty Schedule
Under Section 33 read with the Schedule to the DPDP Act, non-compliance attracts substantial financial liabilities determined by the Data Protection Board of India:
- Up to ₹250 Crore: Failure to take reasonable security safeguards to prevent a personal data breach (Section 8(5)).
- Up to ₹200 Crore: Failure to notify the Board or affected Data Principals of a personal data breach (Section 8(6)).
- Up to ₹200 Crore: Non-fulfilment of obligations regarding children's data or persons with disabilities (Section 9).
- Up to ₹150 Crore: Failure to fulfill additional obligations applicable to Significant Data Fiduciaries (Section 10).
- Up to ₹50 Crore: Failure to comply with any other residual statutory provisions or rules under the Act.
SECTION 4 — Interlocking Regulatory Risks
Financial Intelligence Unit (FIU-IND) Compliance Under PMLA
Real estate agents fall under the definition of 'Reporting Entities' under the Prevention of Money Laundering Act (PMLA). Beyond maintaining KYC logs for 5 years, entities must register on the FIU-IND FINNET Portal and regularly submit Suspicious Transaction Reports (STRs) and Cash Transaction Reports (CTRs). Monetary penalties under Section 13 for record-keeping failures range from ₹10,000 to ₹1 Lakh per infraction, independent of criminal prosecution under Sections 3 and 4 for active money-laundering offenses.
CERT-In Cyber Incident Reporting Standards
Under the Cyber Security Directions issued by the Indian Computer Emergency Response Team (CERT-In), real estate entities must report mandatory cybersecurity incidents (such as ransomware attacks, unauthorized system access, or data leaks) within 6 hours of detection. Non-compliance invites criminal sanctions under Section 70B(7) of the Information Technology Act, including imprisonment up to 1 year, fines up to ₹1 Lakh, or both.
SECTION 5 — Strategic Action Plan for Real Estate Entities
To achieve cross-sectoral compliance without disrupting business velocity, real estate developers and intermediary firms should execute a structured overhaul:
- Audit Data Flow: Map every data ingestion point across online lead engines, sales galleries, booking forms, and third-party CRM platforms.
- Redraft Legal Instruments: Revise customer booking forms, privacy policies, and vendor contracts to incorporate itemized consent notices and statutory DPA clauses.
- Establish Data Retention Maps: Create automated data purging systems that categorize data by statutory retention schedules (GST, Income Tax, PMLA, RERA) while automatically wiping non-retained, non-essential data.
- Deploy Cyber Escalation Protocols: Establish operational playbooks to meet CERT-In's 6-hour incident reporting window and DPBI breach notification standards.
SECTION 6 — How Can JTS Lex Assist, if needed?
JTS Lex provides comprehensive regulatory advisory and compliance solutions tailored specifically to the real estate and prop-tech ecosystems. Our legal practice assists clients through:
- DPDP & Sectoral Audits: Conducting detailed data inventory mapping across customer booking platforms, vendor networks, and internal legal records.
- Documentation Overhaul: Drafting and updating DPDP-compliant consent forms, privacy notices, third-party Data Processing Agreements (DPAs), and customer contracts.
- Data Governance & Retention Frameworks: Structuring customized data lifecycle and purging protocols that align DPDP erasure rules with mandatory retention timelines under GST, Income Tax, PMLA, and RERA.
- Cyber Incident & FIU Advisory: Formulating response mechanisms for CERT-In incident reporting windows and assisting reporting entities with PMLA compliance and FIU-IND registrations.
DPDP ACT COMPLIANCE FOR THE FMCG SECTOR →
Legal perspectives and a practical compliance roadmap for Fast-Moving Consumer Goods businesses under the DPDP Act, 2023. Read Article
